feat(http): honor config.cafile and config.capath

Composer's config.cafile/config.capath were accepted by the config
command but ignored by every HTTP request. Centralize reqwest client
construction in mozart_core::http, pre-load the configured CA bundle
at startup, and route every callsite (registry, vcs drivers, diagnose,
self-update) through the shared builder so user-supplied roots are
actually used during HTTPS verification.

1 files changed, 2 insertions, 4 deletions

diff --git a/crates/mozart/src/commands/self_update.rs b/crates/mozart/src/commands/self_update.rs
index afc77f3..2c7c59b 100644
--- a/crates/mozart/src/commands/self_update.rs
+++ b/crates/mozart/src/commands/self_update.rs
@@ -150,9 +150,8 @@ fn version_from_backup(path: &Path) -> String {
 async fn fetch_releases(include_prerelease: bool) -> anyhow::Result<Vec<GitHubRelease>> {
     let url = format!("{GITHUB_API_BASE}/{GITHUB_REPO}/releases");
 
-    let client = reqwest::Client::builder()
+    let client = mozart_core::http::client_builder()
         .timeout(std::time::Duration::from_secs(30))
-        .user_agent(mozart_core::http::user_agent())
         .build()
         .map_err(|e| anyhow::anyhow!("Could not build HTTP client: {e}"))?;
 
@@ -230,9 +229,8 @@ async fn download_asset(
     show_progress: bool,
     console: &mozart_core::console::Console,
 ) -> anyhow::Result<()> {
-    let client = reqwest::Client::builder()
+    let client = mozart_core::http::client_builder()
         .timeout(std::time::Duration::from_secs(300))
-        .user_agent(mozart_core::http::user_agent())
         .build()
         .map_err(|e| anyhow::anyhow!("Could not build HTTP client: {e}"))?;